Wait how would they observe this? If not owner of the domain, and likely not owner of the client (random residential proxy)? Unless this is HTTP+MITM.

NANOG is the North American Network Operators Group.

femboy.cat is sending HTTP requests from nearly every corner of the Earth.